In today’s rapidly evolving tech landscape, memory safety has become a critical concern for developers, team leaders, and organisations alike. Recently, the White House National Office of the National Cyber Director (ONCD) urged the tech industry to adopt memory-safe programming languages like Rust to mitigate escalating cybersecurity risks [1].
The Cybersecurity and Infrastructure Security Agency (CISA) guidance makes clear that memory safety is not only a developer issue. C-suite and technical leaders are being urged to take the lead in publishing and implementing memory-safe roadmaps [2].
While languages such as C and C++ will remain powerful tools, they are prone to memory safety vulnerabilities that can lead to security breaches. If memory safety is not considered and controlled from the outset, these vulnerabilities can escalate, compromising the integrity and reliability of software systems.
The Legacy Dilemma
For companies deeply invested in C and C++, the directive to transition to memory-safe languages presents a stark reality. The sheer volume of legacy code, estimated at over 2.8 trillion lines written in the last two decades alone [3], with likely billions written in C and C++, makes a complete transition to other languages unfeasible — at least in our lifetimes. Much of this code is in C and C++, reflecting their long dominance in systems programming.
Decades of C/C++ development have entrenched these languages as foundational technologies powering everything from operating systems and embedded devices to IoT platforms and real-time applications [4]. Replacing C across such an extensive and integral landscape would not only require immense financial resources but also risk disrupting critical systems that millions rely on daily.
Lessons from Language Mandates
Mandating a shift to a new programming language is not without its challenges. A notable example is Ada, which in the early 1980s was mandated by the U.S. Department of Defense (DoD) as the required language for most defence software projects [9a]. Ada was designed for high-reliability and real-time systems, and the mandate aimed to standardise development across the military. However, despite its technical strengths, Ada has not supplanted C or C++. Over time, exceptions to the mandate multiplied, and by the late 1990s the policy was formally rescinded [9b].
Today, Ada is primarily used in niche sectors where safety and reliability are paramount, such as aerospace, defence, and critical infrastructure. The Ada case highlights how entrenched legacy codebases, high retraining costs, and the significant investment required to transition existing systems can undermine even government-backed language mandates.
Similarly, Java provides another perspective on language adoption. Although not typically mandated by governments, Java has become the backbone of enterprise applications worldwide due to its robust memory safety features and extensive ecosystem. Many organisations have standardised on Java to enhance security and maintainability, effectively creating an internal mandate to prioritise Java for new projects and system upgrades [10].
These examples illustrate that language mandates — whether driven by government policies or industry standards — can lead to improved safety and security but also encounter significant adoption hurdles. They emphasise the importance of strategic planning and resource allocation when considering a transition to more memory-safe languages.
Developers at the Crossroads
Software developers face their own set of challenges in this environment. While the industry is increasingly embracing memory-safe languages to enhance security, C remains the backbone of countless systems and is expected to stay essential for at least the next two decades [5]. This enduring relevance ensures that expertise in C remains highly valuable. However, to stay ahead in an evolving cybersecurity landscape, developers are encouraged to augment their C skills with memory safety practices and tools.
The Unstoppable Force of C and C++
Despite many modern programming languages pledging to enhance memory safety, C’s enduring legacy and foundational role in software development make it an indispensable asset. The investment in mastering C and C++ continues to be highly worthwhile, as their unparalleled performance and control remain unmatched. These languages are not going anywhere; instead, they will coexist with newer languages, maintaining their position as the lingua franca of programming for years to come [6].
Both the WG14 and WG21 ISC language committees for C and C++ have undefined behaviour study groups and memory safety study groups to improve matters.
Beyond Language Choice
Memory safety is fundamentally a programming challenge, not solely a language problem. While Rust’s borrow checker provides strong memory and concurrency safety guarantees, it only addresses a fraction of the most dangerous software weaknesses [7]. Additionally, a recent search for CVEs related to Rust returned 466 CVE records [8].
Over 70% of Rust crates rely on C/C++ dependencies [11], introducing unsafe elements that the borrow checker cannot verify and creating potential vulnerabilities. Moreover, Rust is not yet among the top 10 programming languages according to the TIOBE Index [12], and its adoption on platforms like GitHub still lags behind more established languages like C++ [13].
As Rust is relatively young — first appearing in 2010 — it has not had the same time to mature and build the extensive libraries and community support that languages like C++ have. When comparing Rust’s uptake to C++ at a similar stage in their development, it is clear that Rust has made impressive progress in building a community and ecosystem. However, C++ achieved far broader adoption during the same relative period, benefiting from its direct lineage from C and its early role in powering mainstream operating systems, compilers, and commercial applications [15]. Rust’s trajectory is notable, but its reach remains more limited compared to the explosive growth that C++ experienced in its formative years.
Practical Solutions Over Complete Overhauls
Rewriting software from C and C++ to Rust is technically challenging and economically burdensome. Instead of a complete overhaul, practical alternatives exist. Enhancing memory safety within existing C and C++ codebases is not only feasible but also essential. Companies can proactively address memory safety issues through rigorous analysis, vulnerability identification, and targeted refactoring. Additionally, re-skilling development teams to apply memory-safe programming techniques ensures that existing codebases are fortified against potential threats without the need for extensive rewrites.
The Risks of Ignoring Memory Safety
Neglecting memory safety can have severe repercussions beyond security breaches. Companies may inadvertently breach legal or regulatory standards, exposing themselves to hefty fines and legal actions. Moreover, memory safety issues can erode customer trust and damage credibility. Ensuring memory safety from the outset is not just a technical necessity but a business imperative.
References
[1] White House, Office of the National Cyber Director (ONCD), Back to the Building Blocks: A Path Toward Secure and Measurable Software, Washington, DC, USA, Feb. 2024. [Online]. Available: https://bidenwhitehouse.archives.gov/wp-content/uploads/2024/02/Final-ONCD-Technical-Report.pdf
[2] Cybersecurity and Infrastructure Security Agency (CISA), The Case for Memory Safe Roadmaps, Washington, DC, USA, Dec. 2023. [Online]. Available: https://www.cisa.gov/sites/default/files/2023-12/The-Case-for-Memory-Safe-Roadmaps-508c.pdf
[3] M. Stack, “How Much Computer Code Has Been Written,” Medium, 2019. [Online]. Available: https://medium.com/modern-stack/how-much-computer-code-has-been-written-c8c03100f459
[4] Toptal, “After All These Years, the World Is Still Powered by C Programming.” [Online]. Available: https://www.toptal.com/c/after-all-these-years-the-world-is-still-powered-by-c-programming
[5] Barr Group, “Embedded Systems Programming Languages Survey,” Barr Group Blog, 2018. [Online]. Available: https://barrgroup.com/blog/embedded-systems-programming-languages-2018
[6] IEEE Spectrum, “The Top Programming Languages 2023,” IEEE Spectrum, 2023. [Online]. Available: https://spectrum.ieee.org/the-top-programming-languages-2023
[7] Software Engineering Institute, Carnegie Mellon University (SEI/CMU), “Rust Software Security: A Current State Assessment,” SEI Blog, 2022. [Online]. Available: https://www.sei.cmu.edu/blog/rust-software-security-a-current-state-assessment/
[8] MITRE, “CVE Search Results for Rust,” CVE Database. [Online]. Available: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust
[9a] U.S. Department of Defense, Department of Defense Directive 3405.1: Computer Programming Language Policy (Ada), Apr. 2, 1987. [Online]. Available: https://apps.dtic.mil/sti/pdfs/ADA177632.pdf
[9b] U.S. Department of Defense, Memorandum: Rescission of the Mandatory Use of the Ada Programming Language, June 29, 1997. [Online]. Available: https://apps.dtic.mil/sti/pdfs/ADA326203.pdf
[10] New Relic, State of the Java Ecosystem 2023, San Francisco, CA, USA, Apr. 2023. [Online]. Available: https://newrelic.com/sites/default/files/2023-04/newrelic-2023-state-of-the-java-ecosystem-2023-04-20.pdf
[11] OpenSSF, “Strengthening the Fort: OpenSSF Releases Compiler Options Hardening Guide for C and C++,” OpenSSF Blog, Nov. 2023. [Online]. Available: https://openssf.org/blog/2023/11/29/strengthening-the-fort-openssf-releases-compiler-options-hardening-guide-for-c-and-c/
[12] S. Vaughan-Nichols, “Python Keeps Top Spot in TIOBE Index, Rust Rising,” TechRepublic, Oct. 2023. [Online]. Available: https://www.techrepublic.com/article/programming-languages-python-takes-no-1-spot-tiobe-index/
[13] GitHub, The State of the Octoverse 2023, GitHub, San Francisco, CA, USA, 2023. [Online]. Available: https://octoverse.github.com/
[14] Software Engineering Institute, Carnegie Mellon University (SEI/CMU), “What Recent Vulnerabilities Mean to Rust,” SEI Blog, 2023. [Online]. Available: https://www.sei.cmu.edu/blog/what-recent-vulnerabilities-mean-to-rust/
[15] S. O’Grady, “The RedMonk Programming Language Rankings: June 2024,” RedMonk Blog, Sept. 2024. [Online]. Available: https://redmonk.com/sogrady/2024/09/12/language-rankings-6-24/
[16] Lindy effect, March 2006, https://en.wikipedia.org/wiki/Lindy_effect
